geointel/docs/DEPENDENCY_POLICY.md

Dependency Policy

GeoIntel deliberately uses technologies matching the GeoAI Engineer profile. Dependencies must support the core goal: geospatial processing, remote sensing, AI inference, QA/QC, and professional frontend visualization.

Approved backend core

• FastAPI
• Uvicorn
• Pydantic
• SQLAlchemy
• Alembic
• GeoAlchemy2
• psycopg
• python-multipart
• RDFLib for standards-compliant parsing of bounded official RDF/DCAT source catalogues. It is pure Python and does not fetch provider distributions.

Approved GIS/remote-sensing

• GeoPandas
• Shapely
• PyProj
• Rasterio
• GDAL where available
• Fiona or pyogrio where needed
• NumPy
• OpenCV when needed for image processing

Docker GIS runtime

The backend Docker image may install the approved gis optional dependency group so the deployed workbench has real raster/vector runtime capability:

• rasterio
• numpy
• pillow
• geopandas
• pyogrio

The Docker image may also install GDAL, GEOS and PROJ system packages required by those GIS libraries. This does not enable new product behavior by itself; it only allows existing raster/vector endpoints to run when requested.

AI dependencies remain separate in the ai optional dependency group and must not be installed by the default Docker backend image unless an explicit AI image or profile is introduced later.

The opt-in Unraid all-in-one AI build is NVIDIA-GPU-oriented. It installs the pinned PyTorch/torchvision pair from the CUDA 12.8 wheel index before installing the ai extra. The production runtime exposes the NVIDIA device, selects YOLO_DEVICE=cuda:0 and sets YOLO_REQUIRE_CUDA=true, so missing CUDA fails closed instead of silently falling back to CPU. The index and versions remain explicit Docker build arguments and require live driver/runtime validation on Tower before release promotion. CUDA 12.8 is deliberately below the Tower driver's reported CUDA 12.9 capability; a newer wheel index may not be promoted merely because it exists when torch.cuda.is_available() fails on that driver.

Docker dependency metadata is copied before application source. Backend source changes therefore reuse the dependency layer while changes to pyproject.toml still invalidate it correctly. Runtime GIS and YOLO import/preflight smokes run after the complete backend source is copied.

Approved AI

• PyTorch
• Ultralytics
• Segment Anything only after detection foundation works

Approved frontend

• React
• TypeScript
• Vite
• MapLibre GL
• Deck.gl
• TanStack Query
• Zustand or React context for local UI state
• Recharts for charts

Add-dependency rule

Before adding a dependency:

1. Explain why existing dependencies are insufficient.
2. Add it to this document.
3. Add setup notes if it has native/system requirements.
4. Ensure Docker build still works.

Avoid in V1

• Heavy MLOps platforms.
• User auth frameworks.
• Full workflow orchestration stacks beyond simple queueing.
• Unnecessary UI component mega-libraries.